CVE-2021-4291lowCWE-79

CVE-2021-4291: low-severity vulnerability in OpenMRS Admin UI Module

OpenMRS Admin UI Module location.gsp cross site scripting

Published 27 Dec 2022 · Updated 03 Aug 2024

Follow this CVE + Monitor Admin UI Module

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.5epss 1.0%

A vulnerability was found in OpenMRS Admin UI Module up to 1.5.x. It has been declared as problematic. This vulnerability affects unknown code of the file omod/src/main/webapp/pages/metadata/locations/location.gsp. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.6.0 is able to address this issue. The name of the patch is a7eefb5f69f6c50a3bffcb138bb8ea57cb41a9b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216916.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Affected products

OpenMRS · Admin UI Module

Related CVEs — OpenMRS Admin UI Module

In the same product, most dangerous first.

CVE-2020-36636LOWOpenMRS Admin UI Module Account Setup AccountPageController.java sendErrorMessage cross site scriptingEPSS 1.0%CVE-2021-4292LOWOpenMRS Admin UI Module Manage Privilege Page privilege.gsp cross site scriptingEPSS 1.0%

References

https://github.com/openmrs/openmrs-module-adminui/commit/a7eefb5f69f6c50a3bffcb138bb8ea57cb41a9b6 https://github.com/openmrs/openmrs-module-adminui/pull/61 https://github.com/openmrs/openmrs-module-adminui/releases/tag/1.6.0 https://vuldb.com/?ctiid.216916 https://vuldb.com/?id.216916